Filo

Privacy policy

In force since 28 September 2026 · version 2.1

This is an English translation provided for convenience. In case of any discrepancy, the Italian version prevails.

This document explains which personal data Filo processes, why, for how long and with whom it is shared. It is drawn up pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

1. Who processes your data

The data controller is:

We have not appointed a Data Protection Officer (DPO), as the conditions set out in Art. 37 GDPR do not apply. For any matter concerning personal data, write to the address above.

2. What data we process

Data you provide to us

• Account — email address and, if you sign in with Google or Apple, the associated name. If you use Apple's “Hide My Email”, we receive only the anonymous forwarding address.
• Planner content — to-dos, deadlines, appointments, projects, notes and the context you assign to projects.
• Assistant memory — people, places and clients you choose to have Filo remember (for example “my barber is Maurizio, Via Roma 3”), together with the information you associate with each of them.
• Messages to the assistant — the text you type or dictate in the chat.
• Support requests — the content of the messages you send us for support and the email address you write from.

Data generated through use

• Count of messages to the assistant — how many you have used in the month, in order to apply the free plan quota.
• Subscription status — whether you have Filo Pro, the type of plan and its expiry date.
• Ratings of replies — when you tap 👍 or 👎 on a reply, or correct a card before saving it, we record the rating, the sentence that generated it and which fields you corrected. This helps us understand where the assistant gets things wrong. This data stays in your personal space and is deleted together with the account.
• Diagnostics and crashes — if the app runs into an error, we receive a technical report (device model, system version, error trace) via Firebase Crashlytics.
• Usage statistics — through Google Analytics for Firebase we record that certain actions have taken place: a sign-in, the saving of certain items in the planner, the connection of a calendar, the opening of the price list, the start of a subscription. None of the content reaches us: no title, no note, no name, no date of your commitments — only the fact that the action took place and, at most, how many items you saved at once. These statistics serve to understand where people get stuck, not to observe you.

Data you give access to, through a permission

• Calendar — if you connect Google Calendar (OAuth consent, revocable at any time) or the device calendar (system permission), we read the events in order to show them in the app and, when you write to the assistant, so that it can take your commitments into account (see section 4). If you enable two-way mode, we write the appointments created in Filo to the calendar you choose. We do not use calendar data for any other purpose: never for advertising, never to train artificial intelligence models.
• Microphone — dictation uses the operating system's speech recognition (Apple or Google). Filo receives only the transcribed text; the audio is handled by the system in accordance with the device manufacturer's privacy policies.

Data that stays on your device

• Semantic search index — the numerical representations used for searching “by meaning” are computed and stored only on the phone. They never reach us.
• Reminders — notifications for deadlines and appointments are scheduled locally. We do not use server push notifications.
• Contacts — if you enable contacts (system permission, revocable), Filo reads the names, numbers, email addresses and postal addresses of your contacts only on the phone, in order to recognise the people you mention and to let you call them, message them or reach them with a single tap. Contacts are not saved on our servers or sent to the assistant. If you manually link a contact to an item in the planner, we save with that item only the name you have chosen.

3. Why we process it and on what legal basis

The legitimate interest indicated above consists in keeping the service working, secure and improving. You may object at any time by writing to info@orma.digital.

We do not carry out profiling for marketing purposes, behavioural advertising, retargeting, sale or transfer of data to third parties, or automated decision-making that produces legal effects concerning you within the meaning of Art. 22 GDPR. The assistant's proposals are suggestions that you confirm: none of them is saved without your confirmation.

4. The assistant: what is sent and what is not

When you write to the assistant, the following are sent to our backend and from there to Anthropic:

• the text of your message and the recent messages in the conversation;
• an extract of your planner — at most 100 items that are still open — with title, date, time, duration, priority, project and type. This also includes events from connected calendars (Google Calendar or the phone's calendar): this way the assistant can move them, notice overlaps and answer questions about what you have planned;
• the names of connected calendars — at most 20 — in order to choose where to write an appointment;
• your projects — at most 30 — with the description you have written;
• your lists — at most 20 — with the items still to be ticked off, up to 40 per list;
• an extract of the memory — at most 100 entries — with name, type and associated information;
• the cards it has just proposed to you and that you have not yet confirmed, if any;
• today's date and the app language.

The following are not sent: your email address, your name, your account identifier, your address-book contacts, the notes on your items, the description, location and attendees of calendar events, or the semantic search index.

This data is used solely to reply to the message you have written: our server forwards it without storing it, and we do not use it for anything else.

Google Calendar data. The use and transfer to other applications of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. In particular: we use it only for the Filo features you see, we transfer it to Anthropic only to make the assistant work when you write to it, we do not sell it, we do not use it for advertising and we do not use it to develop, improve or train artificial intelligence models.

Under the commercial terms agreed with Anthropic, the data sent is not used to train the models. Anthropic retains it for the time strictly necessary for processing and for the abuse checks provided for in its own terms.

5. Who it is disclosed to

The data is processed by the controller's authorised staff and by the following providers, appointed as data processors pursuant to Art. 28 GDPR:

Subscriptions are sold by Apple and Google through their stores: we do not receive or process your payment card data. We receive only confirmation that a subscription is active.

Data may also be disclosed to public authorities where required by law or for the establishment or defence of a legal claim in court. It is not disseminated.

6. Transfers outside Europe

The content of your planner is stored on servers located in the European Union. Two processing operations, however, involve a transfer to the United States:

• requests to the assistant, processed by Anthropic PBC;
• subscription status, managed by RevenueCat Inc.

Both transfers take place on the basis of the Standard Contractual Clauses approved by the European Commission (EU Implementing Decision 2021/914), supplemented by the additional measures provided for in the respective agreements. You may request a copy by writing to info@orma.digital.

If you do not want any data to leave the European Union, you can use Filo without the assistant: the planner, calendars, views and semantic search work entirely without sending anything to Anthropic.

7. How long we keep it

8. Your rights

You may exercise at any time the rights provided for by Articles 15-22 of the GDPR:

• to access your data and obtain a copy of it;
• to have inaccurate or incomplete data rectified;
• to obtain its erasure;
• to restrict its processing or object to it;
• to receive it in a machine-readable format and transmit it to another controller;
• to withdraw consent already given, without affecting the lawfulness of processing carried out before the withdrawal.

If you believe that the processing infringes the GDPR, you may lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority) (Piazza Venezia 11, 00187 Roma — garanteprivacy.it) or with the authority of the State in which you reside, or bring proceedings before the judicial authority.

9. Security

Data is encrypted in transit (TLS) and encrypted at rest by our infrastructure providers. Access to content is governed by rules that allow each account to read and write only its own space. The keys for external services are kept in a secrets manager and are not present in the app installed on your device.

No system is invulnerable: in the event of a personal data breach that is likely to result in a high risk to your rights, we will inform you without undue delay, as required by Art. 34 GDPR.

10. Minors

Filo is not intended for children under 14 and we do not knowingly collect their data. If you are under 18, use the app with the involvement of a parent or of the person exercising parental responsibility. If we become aware of an account registered to a child under 14, we will delete it.

11. The filo.orma.digital website

The website uses Google Tag Manager to manage measurement tools. On your first visit you will find a banner with two equivalent choices, Accept and Decline: until you choose, and if you decline, no measurement cookie is set and no browsing data is sent. Declining does not restrict your use of the website in any way.

Technically, this is ensured by Google's consent mode, set to “denied” for all categories before the container is even loaded: the tags remain inactive until you make your choice. Your choice is stored in the browser's local storage, not in a cookie.

The consent we ask for concerns measurement only: by accepting you do not authorise advertising or profiling, which remain disabled regardless. Should we wish to introduce them in the future, a separate request would be required.

The first two are set only if you consent. The third appears only if you submit the waiting list form and is a security measure, as explained above. Your consent choice is stored in the browser's local storage, not in a cookie.

You can change your mind at any time via the “Cookie preferences” link at the bottom of every page: it reopens the same request and your new choice takes effect immediately.

The only exception applies if you decide to join the waiting list. At the moment you press the button — and not before — Google reCAPTCHA Enterprise is loaded; it analyses technical browsing data to distinguish people from automated programs and sets its own cookie. This is a security measure necessary to provide the service you requested at that moment, and therefore does not require prior consent under Art. 122 of the Italian Privacy Code (Codice Privacy); if you do not sign up, it is never activated. Google's privacy policy and terms apply.

The waiting list sign-up form collects your email address and browser language, on the basis of your consent, for the sole purpose of notifying you when the app becomes available. You will not receive any other communications. The address is recorded in our systems and in Orma's email list, Orma remaining the same data controller. You can unsubscribe at any time by writing to info@orma.digital.

12. Changes to this policy

If we change the way we process data, we will update this page and the date at the top. If the change is substantial, we will let you know within the app or by email before it takes effect. Previous versions are available on request.